{"action":"created","issue":{"url":"https://api.github.com/repos/sass/node-sass/issues/2164","repository_url":"https://api.github.com/repos/sass/node-sass","labels_url":"https://api.github.com/repos/sass/node-sass/issues/2164/labels{/name}","comments_url":"https://api.github.com/repos/sass/node-sass/issues/2164/comments","events_url":"https://api.github.com/repos/sass/node-sass/issues/2164/events","html_url":"https://github.com/sass/node-sass/issues/2164","id":276386458,"number":2164,"title":"Latest release has vulnerable tunnel-agent as a dependency","user":{"login":"dominykas","id":505619,"avatar_url":"https://avatars1.githubusercontent.com/u/505619?v=4","gravatar_id":"","url":"https://api.github.com/users/dominykas","html_url":"https://github.com/dominykas","followers_url":"https://api.github.com/users/dominykas/followers","following_url":"https://api.github.com/users/dominykas/following{/other_user}","gists_url":"https://api.github.com/users/dominykas/gists{/gist_id}","starred_url":"https://api.github.com/users/dominykas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dominykas/subscriptions","organizations_url":"https://api.github.com/users/dominykas/orgs","repos_url":"https://api.github.com/users/dominykas/repos","events_url":"https://api.github.com/users/dominykas/events{/privacy}","received_events_url":"https://api.github.com/users/dominykas/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-23T14:03:37Z","updated_at":"2017-11-23T15:03:14Z","closed_at":"2017-11-23T15:03:14Z","author_association":"NONE","body":"When reporting an bug, **you must provide this information**:\r\n\r\n- NPM version (`npm -v`): 5.5.1\r\n- Node version (`node -v`): 6.12.0\r\n- Node Process (`node -p process.versions`):\r\n```\r\n{ http_parser: '2.7.0',\r\n  node: '6.12.0',\r\n  v8: '5.1.281.108',\r\n  uv: '1.15.0',\r\n  zlib: '1.2.11',\r\n  ares: '1.10.1-DEV',\r\n  icu: '58.2',\r\n  modules: '48',\r\n  openssl: '1.0.2m' }\r\n```\r\n- Node Platform (`node -p process.platform`): darwin\r\n- Node architecture (`node -p process.arch`): x64\r\n- node-sass version (`node -p \"require('node-sass').info\"`):\r\n```\r\nnode-sass\t4.7.2\t(Wrapper)\t[JavaScript]\r\nlibsass  \t3.5.0.beta.2\t(Sass Compiler)\t[C/C++]\r\n```\r\n- npm node-sass versions (`npm ls node-sass`): node-sass@4.7.2 \r\n\r\n---\r\n\r\nhttps://github.com/sass/node-sass/commit/187d8c91dff15d4655bfe0cb1155d5ca8a256184 pinned `request` to `v2.79.x`, which depends on a [vulnerable version of `tunnel-agent`](https://snyk.io/vuln/npm:tunnel-agent:20170305).\r\n\r\nI understand that the change was done because newer versions of `request` require node v4+ and the intention of node-sass is to support older versions of node? This is probably the wrong place to have the debate whether the obsolete, unmaintained, insecure versions of node _should_ be supported, but I wonder if there is any decision on what is the plan for deprecating them (if any)?\r\n\r\nIf the intention is to keep the support for old-node, then aside from ignoring the vulnerability in projects consuming node-sass (bad idea), the fix would be to not use request, but rather to look for an alternative? Would a PR to do that be acceptable?\r\n"},"comment":{"url":"https://api.github.com/repos/sass/node-sass/issues/comments/346640696","html_url":"https://github.com/sass/node-sass/issues/2164#issuecomment-346640696","issue_url":"https://api.github.com/repos/sass/node-sass/issues/2164","id":346640696,"user":{"login":"nschonni","id":1297909,"avatar_url":"https://avatars2.githubusercontent.com/u/1297909?v=4","gravatar_id":"","url":"https://api.github.com/users/nschonni","html_url":"https://github.com/nschonni","followers_url":"https://api.github.com/users/nschonni/followers","following_url":"https://api.github.com/users/nschonni/following{/other_user}","gists_url":"https://api.github.com/users/nschonni/gists{/gist_id}","starred_url":"https://api.github.com/users/nschonni/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nschonni/subscriptions","organizations_url":"https://api.github.com/users/nschonni/orgs","repos_url":"https://api.github.com/users/nschonni/repos","events_url":"https://api.github.com/users/nschonni/events{/privacy}","received_events_url":"https://api.github.com/users/nschonni/received_events","type":"User","site_admin":false},"created_at":"2017-11-23T15:03:14Z","updated_at":"2017-11-23T15:03:14Z","author_association":"CONTRIBUTOR","body":"Discussions for the next major are happening here https://github.com/sass/node-sass/issues/2111\r\nThis dependency is only used for our install and not for any runtime code"}}
{"actor":{"display_login":"nschonni"}}